diff --git a/usr/sbin/sshutterd b/usr/sbin/sshutterd index 39db244..509dc45 100755 --- a/usr/sbin/sshutterd +++ b/usr/sbin/sshutterd @@ -22,18 +22,25 @@ if [ "$UID" -ne 0 ]; then fi # Main loop +oldstate="" while [ true ]; do ping -c 3 "$TARGET" 1>/dev/null if [ "$?" -eq 0 ]; then # Ping successful, apply shutter - log "[sshutter] Blocking port 22 for IPs outside $WHITELIST" + if [ "$oldstate" != "blocked" ]; then + log "[sshutter] Blocking port 22 for IPs outside $WHITELIST" + oldstate="blocked" + fi nft add table inet filter nft add chain inet filter sshutterv4 \{ type filter hook input priority filter \; policy accept \; \} nft add rule inet filter sshutterv4 tcp dport "$PORT" ip saddr "$WHITELIST" accept nft add rule inet filter sshutterv4 tcp dport "$PORT" drop else # Ping failed, lift shutter - log "[sshutter] Releasing port block" + if [ "$oldstate" != "released" ]; then + log "[sshutter] Releasing port block" + oldstate="released" + fi nft destroy chain inet filter sshutterv4 fi